<html>
<head><meta charset="utf-8"><title>invalidate through drop · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html">invalidate through drop</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="184103427"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184103427" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184103427">(Dec 23 2019 at 13:15)</a>:</h4>
<p>Is this code sound:</p>
<div class="codehilite"><pre><span></span><span class="k">struct</span> <span class="nc">S</span><span class="p">(</span><span class="nb">Vec</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">s</span>: <span class="nc">S</span><span class="p">;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">s</span><span class="p">.</span><span class="mi">0</span><span class="p">);</span><span class="w"></span>
<span class="c1">// s.0 contains a field that has been dropped</span>
<span class="n">ptr</span>::<span class="n">write</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">s</span><span class="p">.</span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="nb">Vec</span>::<span class="n">new</span><span class="p">();</span><span class="w"> </span><span class="c1">// &amp;mut s.0 creates a ref to dropped field</span>
</pre></div>


<p>?</p>
<p>In particular, creating a <code>&amp;mut s</code> or <code>&amp;mut s.0</code> after <code>s.0</code> has been dropped, might create an invalid reference ? (EDIT: e.g. the <code>Vec</code> contains a <code>NonNull&lt;u8&gt;</code>, which is a nonnull ptr value, which in this particular case gets dropped, and after the drop we don't guarantee that the pointer is nonnull anymore)</p>



<a name="184103829"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184103829" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184103829">(Dec 23 2019 at 13:23)</a>:</h4>
<p>Is that meant to be <code>let mut s: S = S(Vec::new())</code> or so?</p>



<a name="184103842"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184103842" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184103842">(Dec 23 2019 at 13:23)</a>:</h4>
<p>as is that doesn't compile since s isn't initialized</p>



<a name="184104183"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184104183" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184104183">(Dec 23 2019 at 13:29)</a>:</h4>
<p>it doesn't matter how its initialized, only that such a binding exists</p>



<a name="184104191"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184104191" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184104191">(Dec 23 2019 at 13:29)</a>:</h4>
<p>it could be <code>fn foo(mut x: S) { ...code goes here... }</code></p>



<a name="184104385"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184104385" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184104385">(Dec 23 2019 at 13:33)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="k">struct</span> <span class="nc">S</span><span class="p">(</span><span class="nb">Vec</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">s</span>: <span class="nc">S</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">...;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">s</span><span class="p">.</span><span class="mi">0</span><span class="p">);</span><span class="w"></span>
<span class="c1">// s.0 contains a field that has been dropped</span>
<span class="n">ptr</span>::<span class="n">write</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">s</span><span class="p">.</span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="nb">Vec</span>::<span class="n">new</span><span class="p">();</span><span class="w"> </span><span class="c1">// &amp;mut s.0 creates a ref to dropped field</span>
</pre></div>


<p>is then more accurate perhaps?</p>



<a name="184104397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184104397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184104397">(Dec 23 2019 at 13:33)</a>:</h4>
<p>i.e., actually initializing the field</p>



<a name="184104482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184104482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184104482">(Dec 23 2019 at 13:34)</a>:</h4>
<p>sure</p>



<a name="184105254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184105254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184105254">(Dec 23 2019 at 13:47)</a>:</h4>
<p>Yes this is sound as long as you make sure that no panic is possible while the value is "dropped".</p>



<a name="184105650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184105650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184105650">(Dec 23 2019 at 13:53)</a>:</h4>
<p>So what's the "value" of the dropped <code>Vec</code> ?</p>



<a name="184105762"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184105762" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184105762">(Dec 23 2019 at 13:54)</a>:</h4>
<p>Like maybe an even simpler example:</p>
<div class="codehilite"><pre><span></span><span class="k">struct</span> <span class="nc">S</span><span class="p">(</span><span class="n">NonNull</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">s</span>: <span class="nc">S</span><span class="p">;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">s</span><span class="p">.</span><span class="mi">0</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="n">NonNull</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">s</span><span class="p">.</span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
</pre></div>



<a name="184105806"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184105806" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184105806">(Dec 23 2019 at 13:55)</a>:</h4>
<p>The <code>NonNull&lt;u8&gt;</code> has been dropped, yet the validity invariant of <code>NonNull&lt;u8&gt;</code> requires it to be <code>nonnull</code></p>



<a name="184105897"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184105897" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184105897">(Dec 23 2019 at 13:56)</a>:</h4>
<p>AFAICT dropping a value uninitializes its storage?</p>



<a name="184105908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184105908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184105908">(Dec 23 2019 at 13:56)</a>:</h4>
<p>So <code>x</code> would be a reference to uninitialized memory, and therefore invalid</p>



<a name="184106225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184106225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184106225">(Dec 23 2019 at 14:01)</a>:</h4>
<p>Maybe a different way to phrase it would be whether a valid implementation of <code>ptr::drop_in_place</code> can write <code>mem::uninitialized</code> after dropping the values through the pointer ?</p>



<a name="184106305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184106305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184106305">(Dec 23 2019 at 14:02)</a>:</h4>
<p>Or whether after dropping a value its storage becomes uninitialized</p>



<a name="184106457"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184106457" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184106457">(Dec 23 2019 at 14:04)</a>:</h4>
<p>(essentially, creating the <code>&amp;mut s.0</code> after the <code>ptr::drop_in_place</code> is a "use-after-drop")</p>



<a name="184108274"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184108274" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184108274">(Dec 23 2019 at 14:35)</a>:</h4>
<p>Normally dropping a value can uninit the storage because the storage is on a stack frame which you might have just popped away because drops normally only fires when scopes close. However, that's just the stack popping, there's no reason to write uninit if it's dropped as part of <code>drop_in_place</code>.</p>



<a name="184108809"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184108809" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184108809">(Dec 23 2019 at 14:44)</a>:</h4>
<p><code>drop_in_place</code> is unsafe and can trivially lead to a double-free, but I don't see anything that would also allow it to just write uninit and break validity invariants that way. It might be under specified to the point where it's technically allowed to do that, but it should not and if it did start doing that in some new release of rust you'd get torches and pitchforks at the door.</p>



<a name="184158222"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184158222" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184158222">(Dec 24 2019 at 08:44)</a>:</h4>
<p>As far as I can tell, the only potential issue with the first example is that the &amp;mut created in the last line is referring to uninit or otherwise not-safe memory. But this can be trivially side-stepped by using <code>&amp;raw mut s.0</code> (once that syntax is stable) and that's cleaner and more explicit anyway.</p>



<a name="184274146"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184274146" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184274146">(Dec 26 2019 at 17:57)</a>:</h4>
<blockquote>
<p>So what's the "value" of the dropped <code>Vec</code> ?</p>
</blockquote>
<p>there's no such thing. or do you mean "what are the contents of the memory where the <code>Vec</code> is stored"? I don't think there is any general way to tell. It's whatever <code>drop_in_place</code> left behind. It must satisfy the validity invariant, I guess, but that's about it.</p>



<a name="184374602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374602">(Dec 28 2019 at 13:09)</a>:</h4>
<p>So <code>drop_in_place</code> must satisfy the validity invariant ?</p>



<a name="184374616"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374616" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374616">(Dec 28 2019 at 13:09)</a>:</h4>
<blockquote>
<p>As far as I can tell, the only potential issue with the first example is that the &amp;mut created in the last line is referring to uninit or otherwise not-safe memory.</p>
</blockquote>
<p>That's the main issue I see as well.</p>



<a name="184374684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374684">(Dec 28 2019 at 13:11)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> IIUC, for <code>drop_in_place</code> to satisfy the validity invariant, <code>Drop::drop(&amp;mut self)</code> needs to satisfy the validity invariant as well.</p>



<a name="184374695"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374695" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374695">(Dec 28 2019 at 13:11)</a>:</h4>
<p>And by satisfy I mean that <code>Drop::drop</code> is not allowed to leave <code>self</code> in an invalid state.</p>



<a name="184374739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374739">(Dec 28 2019 at 13:12)</a>:</h4>
<p>That's something that <code>Drop::drop</code> docs do not spell out though.</p>



<a name="184374744"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374744" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374744">(Dec 28 2019 at 13:12)</a>:</h4>
<p>They shouldn't need to?</p>



<a name="184374751"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374751" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374751">(Dec 28 2019 at 13:13)</a>:</h4>
<p>i.e., <code>&amp;mut self</code> means that the <code>Self</code> must be valid throughout the method</p>



<a name="184374764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374764">(Dec 28 2019 at 13:13)</a>:</h4>
<p>notably, we encounter this in other places too, e.g., <code>AtomicUsize::fetch_sub</code> which ends up dropping the Atomic before the end of the method, while we still have &amp;self in that method</p>



<a name="184374948"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374948" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374948">(Dec 28 2019 at 13:19)</a>:</h4>
<p>notice that the content of the <code>Drop</code> impl doesn't matter</p>



<a name="184374952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374952">(Dec 28 2019 at 13:19)</a>:</h4>
<p>the fields will be dropped  "after" the <code>Drop::drop</code> function finishes, as part of dropping the value</p>



<a name="184374995"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374995" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374995">(Dec 28 2019 at 13:20)</a>:</h4>
<p>i.e. a call to <code>Drop::drop(s)</code> does not only execute the <code>Drop::drop</code> method, but it then subsequently drops the fields of <code>s</code></p>



<a name="184374997"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184374997" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184374997">(Dec 28 2019 at 13:20)</a>:</h4>
<p>and this subsequent dropping of the fields of <code>s</code> would need to leave <code>s</code> in a "valid" state for the example above to not have UB</p>



<a name="184375000"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184375000" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184375000">(Dec 28 2019 at 13:21)</a>:</h4>
<p>In particular, notice that <code>S(Vec&lt;T&gt;)</code> does not implement <code>Drop</code>, its fields do</p>



<a name="184375058"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184375058" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184375058">(Dec 28 2019 at 13:22)</a>:</h4>
<p>the behavior of dropping a field is unspecified</p>



<a name="184375112"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184375112" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184375112">(Dec 28 2019 at 13:24)</a>:</h4>
<p>If I have:</p>
<div class="codehilite"><pre><span></span><span class="k">struct</span> <span class="nc">S</span><span class="p">(</span><span class="kt">i32</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">S</span><span class="p">(</span><span class="mi">42</span><span class="p">);</span><span class="w"></span>
<span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="p">.</span><span class="mi">0</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
</pre></div>


<p>we don't specify anywhere in which state the memory of <code>x</code> is left in after the <code>i32</code> is dropped</p>



<a name="184375125"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184375125" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184375125">(Dec 28 2019 at 13:25)</a>:</h4>
<p>Does the memory of <code>x</code> is left with a <code>S(42)</code> value? Does it become <code>S(uninit)</code> ?</p>



<a name="184375173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184375173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184375173">(Dec 28 2019 at 13:26)</a>:</h4>
<p>If it becomes <code>S(uninit)</code>, then that call to <code>drop_in_place</code> is already UB.</p>



<a name="184376703"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184376703" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184376703">(Dec 28 2019 at 14:12)</a>:</h4>
<p>my understanding is that it does not become uninit, but becomes unknown -- i.e., you should not do anything that could cause access to it</p>



<a name="184376707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184376707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184376707">(Dec 28 2019 at 14:12)</a>:</h4>
<p>(read) access</p>



<a name="184381060"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184381060" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184381060">(Dec 28 2019 at 16:18)</a>:</h4>
<p>Drop isn't specially able to write uninit when other code couldn't. In other words, any place you couldn't write uninit to <code>&amp;mut self</code>, Drop can't do it either.</p>
<p>Drop can safely put your <em>safety</em> invariants out of place (eg: free some memory, de-init an API, etc), but it has no special <em>validity</em> invariant breaking ability at all.</p>



<a name="184381253"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184381253" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184381253">(Dec 28 2019 at 16:25)</a>:</h4>
<p>Yes, that's my understanding as well. Note that this is somewhat unique to drop -- no other safe function has that property. Arguably, Drop::drop maybe should be an unsafe fn because of this (but since you can't call it directly doesn't matter too much)</p>



<a name="184417720"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184417720" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184417720">(Dec 29 2019 at 11:54)</a>:</h4>
<blockquote>
<p>So <code>drop_in_place</code> must satisfy the validity invariant ?</p>
</blockquote>
<p>I cannot parse this question</p>



<a name="184417794"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184417794" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184417794">(Dec 29 2019 at 11:56)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> <span class="user-mention" data-user-id="116122">@simulacrum</span> agreed. And <code>Drop::drop</code> de-facto is <code>unsafe</code>... or rather, it's a magic special snowflake. It doesn't actually have the type <code>fn(&amp;mut Self)</code>, clearly.</p>



<a name="184648974"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184648974" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184648974">(Jan 02 2020 at 12:56)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> you stated:</p>
<blockquote>
<p>It's whatever drop_in_place left behind. It must satisfy the validity invariant, I guess, but that's about it.</p>
</blockquote>
<p>So my question was related to that. What do you mean with the claim that after <code>ptr::drop_in_place(ptr)</code> the memory at <code>ptr</code> must satisfy the validity invariant?</p>



<a name="184649192"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649192" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649192">(Jan 02 2020 at 13:00)</a>:</h4>
<p>Do you literally just mean that? (from the other comments, it appears so)</p>



<a name="184649397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649397">(Jan 02 2020 at 13:04)</a>:</h4>
<blockquote>
<p>my understanding is that it does not become uninit, but becomes unknown -- i.e., you should not do anything that could cause access to it</p>
</blockquote>
<p><span class="user-mention" data-user-id="116122">@simulacrum</span> We don't have an "unknown" state in the abstract machine</p>



<a name="184649422"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649422" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649422">(Jan 02 2020 at 13:04)</a>:</h4>
<p>AFAICT, from reading <span class="user-mention" data-user-id="224471">@Lokathor</span> and <span class="user-mention" data-user-id="120791">@RalfJ</span> comments, <code>Drop::drop</code> cannot violate the validity invariant, and that means it cannot write to the memory any value that isn't valid for the type.</p>



<a name="184649445"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649445" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649445">(Jan 02 2020 at 13:05)</a>:</h4>
<p>That includes "uninit" for some types (for <code>MaybeUninit</code> it would be ok), and probably any kind of "unknown"state.</p>



<a name="184649504"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649504" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649504">(Jan 02 2020 at 13:06)</a>:</h4>
<p>This means it must be ok to read from a memory location after droping its contents, i.e., a read-after-drop is not UB.</p>



<a name="184649517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649517">(Jan 02 2020 at 13:06)</a>:</h4>
<p>And since the memory contains a valid value, why wouldn't such a read be ok ?</p>



<a name="184649524"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649524" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649524">(Jan 02 2020 at 13:06)</a>:</h4>
<p>However, like <span class="user-mention" data-user-id="224471">@Lokathor</span> mentioned, <code>Drop::drop</code> can break the safety invariants of a type</p>



<a name="184649543"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649543" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649543">(Jan 02 2020 at 13:07)</a>:</h4>
<p>so if you have a type for which this is the case, then you need to be extra careful, but none of this is UB per se</p>



<a name="184649621"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649621" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649621">(Jan 02 2020 at 13:08)</a>:</h4>
<p>Just because the memory is valid doesn't make using the value there safe; furthermore, e.g. Box or references would not (technically) be safe to read.</p>



<a name="184649631"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649631" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649631">(Jan 02 2020 at 13:09)</a>:</h4>
<p>A Box is only valid if it is safe to read</p>



<a name="184649641"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649641" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649641">(Jan 02 2020 at 13:09)</a>:</h4>
<p>e.g., because a <code>Box</code> is <code>dereferenceable</code></p>



<a name="184649695"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649695" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649695">(Jan 02 2020 at 13:10)</a>:</h4>
<p>It's also true I think that we consider dropping to end the lifetime of the memory (i.e. llvm can reuse the stack slot for example)</p>



<a name="184649706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649706">(Jan 02 2020 at 13:10)</a>:</h4>
<p>For a type like <code>i32</code>, a double drop is not UB, according to the model being discussed here</p>



<a name="184649717"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649717" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649717">(Jan 02 2020 at 13:10)</a>:</h4>
<p>e.g.:</p>
<div class="codehilite"><pre><span></span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42_</span><span class="k">i32</span><span class="p">;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="p">);</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="p">);</span><span class="w"> </span><span class="c1">// OK</span>
</pre></div>



<a name="184649753"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649753" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649753">(Jan 02 2020 at 13:11)</a>:</h4>
<blockquote>
<p>Just because the memory is valid doesn't make using the value there safe;</p>
</blockquote>
<p>No, as mentioned, <code>Drop::drop</code> is allowed to leave the memory in a state that does not satisfy the safety invariant of a type. But there are many operations for which that is ok.</p>



<a name="184649807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649807">(Jan 02 2020 at 13:12)</a>:</h4>
<p>For example, <code>Vec::set_len</code> can be used to leave the <code>Vec</code> in a state that does not satisfy the safety invariant, and that turns out to be a very useful thing</p>



<a name="184649829"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649829" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649829">(Jan 02 2020 at 13:13)</a>:</h4>
<blockquote>
<p>It's also true I think that we consider dropping to end the lifetime of the memory (i.e. llvm can reuse the stack slot for example)</p>
</blockquote>
<p>That's something that we would need to document somehow.</p>



<a name="184649843"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649843" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649843">(Jan 02 2020 at 13:13)</a>:</h4>
<p>AFAICT we can do that when <code>Drop::drop</code> is called implicitly because then the language makes it impossible for the user to try to access that memory location due to ownership, but we can't do that when the user calls <code>ptr::drop_in_place</code> manually.</p>



<a name="184649896"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649896" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649896">(Jan 02 2020 at 13:14)</a>:</h4>
<p>We could just assert that any operation on dropped values is UB</p>



<a name="184649921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649921">(Jan 02 2020 at 13:15)</a>:</h4>
<p>In general that would require us to add some sort of "dropped" state to the abstract machine</p>



<a name="184649930"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649930" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649930">(Jan 02 2020 at 13:15)</a>:</h4>
<p>i.e., drop_in_place is <em>not</em> required to satisfy validity invariant, though Drop::drop is</p>



<a name="184649942"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649942" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649942">(Jan 02 2020 at 13:15)</a>:</h4>
<p>I don't think so? The value just doesn't exist</p>



<a name="184649949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184649949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184649949">(Jan 02 2020 at 13:16)</a>:</h4>
<p>I think the consensus from above was that Drop::drop and drop_in_place are required to satisfy the validity invariant</p>



<a name="184650001"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650001" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650001">(Jan 02 2020 at 13:16)</a>:</h4>
<p>(basically as currently defined, violating it is instant UB)</p>



<a name="184650004"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650004" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650004">(Jan 02 2020 at 13:16)</a>:</h4>
<p>I think we have consensus that Drop::drop is. I'm not sure about drop_in_place - it takes *mut T, right?</p>



<a name="184650012"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650012" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650012">(Jan 02 2020 at 13:17)</a>:</h4>
<p>Yes, but it drops the memory at the <code>*mut T</code> address</p>



<a name="184650027"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650027" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650027">(Jan 02 2020 at 13:17)</a>:</h4>
<p>So there's no &amp;mut to speak of, technically</p>



<a name="184650039"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650039" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650039">(Jan 02 2020 at 13:17)</a>:</h4>
<p>Since <code>drop_in_place</code> must call <code>Drop::drop(&amp;mut T)</code></p>



<a name="184650082"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650082" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650082">(Jan 02 2020 at 13:18)</a>:</h4>
<p>then that pointer gets dereferenced at some point</p>



<a name="184650084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650084">(Jan 02 2020 at 13:18)</a>:</h4>
<p>Well, yes, the Drop can't do anything</p>



<a name="184650127"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650127" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650127">(Jan 02 2020 at 13:18)</a>:</h4>
<p>But after Drop is called, it could do anything with said memory (e.g. reuse it for some other type, with different validity invariants)</p>



<a name="184650156"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650156" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650156">(Jan 02 2020 at 13:19)</a>:</h4>
<p>The difference is that, when <code>Drop::drop</code> is implicitly called, the memory becomes unaccessible for the rest of the program</p>



<a name="184650167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650167">(Jan 02 2020 at 13:19)</a>:</h4>
<p>when you manually call <code>ptr::drop_in_place(ptr)</code>, the <code>ptr</code> is still accessible</p>



<a name="184650172"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650172" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650172">(Jan 02 2020 at 13:19)</a>:</h4>
<p>in general, if memory is unaccessible, LLVM can do whatever it wants with it</p>



<a name="184650176"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650176" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650176">(Jan 02 2020 at 13:19)</a>:</h4>
<p>the user can't tell</p>



<a name="184650230"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650230" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650230">(Jan 02 2020 at 13:20)</a>:</h4>
<p>However for <code>drop_in_place</code>, were LLVM to use the memory at <code>ptr</code> for something else, the user would be able to tell</p>



<a name="184650255"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650255" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650255">(Jan 02 2020 at 13:21)</a>:</h4>
<p>We could say that memory for which <code>drop_in_place</code> is called can only be written to, but not read from, or something like that</p>



<a name="184650280"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650280" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650280">(Jan 02 2020 at 13:21)</a>:</h4>
<p>I think the <code>ptr</code> itself is still valid, that can't change (<code>*mut T</code> is Copy, I believe)</p>



<a name="184650333"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650333" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650333">(Jan 02 2020 at 13:22)</a>:</h4>
<p>but the memory behind it is not valid to use</p>



<a name="184650341"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650341" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650341">(Jan 02 2020 at 13:22)</a>:</h4>
<p>Well, currently, AFAICT, the memory behind the pointer is valid to use</p>



<a name="184650349"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650349" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650349">(Jan 02 2020 at 13:22)</a>:</h4>
<p>because if <code>ptr::drop_in_place</code> makes it invalid, the behavior is undefined</p>



<a name="184650352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650352">(Jan 02 2020 at 13:22)</a>:</h4>
<p>how so?</p>



<a name="184650362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650362">(Jan 02 2020 at 13:22)</a>:</h4>
<p>an invalid value is undefined behavior</p>



<a name="184650384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650384">(Jan 02 2020 at 13:23)</a>:</h4>
<p>er, well, I'm confused why <code>ptr::drop_in_place</code> making it invalid is UB</p>



<a name="184650399"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650399" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650399">(Jan 02 2020 at 13:23)</a>:</h4>
<p>or, rather, why it would not be acceptable to say that <code>ptr::drop_in_place</code> makes the memory behind <code>*mut T</code> invalid.</p>



<a name="184650403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650403">(Jan 02 2020 at 13:23)</a>:</h4>
<p>because for <code>ptr::drop_in_place</code> to make the memory at pointer invalid, it would need to do: <code>*ptr = invalid;</code></p>



<a name="184650409"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650409" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650409">(Jan 02 2020 at 13:23)</a>:</h4>
<p>and that is UB</p>



<a name="184650462"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650462" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650462">(Jan 02 2020 at 13:24)</a>:</h4>
<p>I would disagree</p>



<a name="184650469"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650469" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650469">(Jan 02 2020 at 13:24)</a>:</h4>
<p>well, not the literal claim</p>



<a name="184650502"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650502" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650502">(Jan 02 2020 at 13:24)</a>:</h4>
<p>I mean, if <code>ptr::drop_in_place(ptr)</code> changes the state of the memory behind <code>ptr</code>, it needs to do so by "writting" to that <code>ptr</code> "somehow"</p>



<a name="184650517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650517">(Jan 02 2020 at 13:25)</a>:</h4>
<p>at least, in the abstract machine (the generated code might do nothing, e.g., like writing <code>undef</code> or so)</p>



<a name="184650525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650525">(Jan 02 2020 at 13:25)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="k">unsafe</span><span class="w"> </span><span class="k">fn</span> <span class="nf">drop_in_place</span><span class="p">(</span><span class="n">ptr</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="nb">Drop</span>::<span class="n">drop</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="n">ptr</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">ptr</span>::<span class="n">write</span><span class="p">(</span><span class="n">ptr</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">SomeOtherType</span><span class="p">,</span><span class="w"> </span><span class="p">...);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="184650601"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650601" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650601">(Jan 02 2020 at 13:26)</a>:</h4>
<p>ah, so your point is that it would be invalid for <code>T</code>, but not for <code>SomeOtherType</code> ?</p>



<a name="184650632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650632">(Jan 02 2020 at 13:26)</a>:</h4>
<p>Basically, yeah</p>



<a name="184650645"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650645" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650645">(Jan 02 2020 at 13:26)</a>:</h4>
<p>yeah that would work i think</p>



<a name="184650661"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650661" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650661">(Jan 02 2020 at 13:27)</a>:</h4>
<p>I'm not sure how many optimizations that allows</p>



<a name="184650674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650674">(Jan 02 2020 at 13:27)</a>:</h4>
<p>Well, I think the main optimization is that <em>if</em> we know that <code>*mut T</code> points to the stack, LLVM/compiler can reuse it</p>



<a name="184650682"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650682" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650682">(Jan 02 2020 at 13:27)</a>:</h4>
<p>(for other types, same type, whatever)</p>



<a name="184650683"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650683" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650683">(Jan 02 2020 at 13:27)</a>:</h4>
<p>only if the user does not write to it afterwards</p>



<a name="184650712"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650712" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650712">(Jan 02 2020 at 13:28)</a>:</h4>
<p>or at least, in the "window" in which the user does not write to it afterwards</p>



<a name="184650734"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650734" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650734">(Jan 02 2020 at 13:28)</a>:</h4>
<p>well, I would argue that the user writing to it <em>is</em> UB, which is why we can make that optimization</p>



<a name="184650741"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650741" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650741">(Jan 02 2020 at 13:28)</a>:</h4>
<p>hmm</p>



<a name="184650760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650760">(Jan 02 2020 at 13:28)</a>:</h4>
<p>notice that <code>Vec::pop</code> uses drop in place to drop an element</p>



<a name="184650768"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650768" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650768">(Jan 02 2020 at 13:28)</a>:</h4>
<p>and then <code>Vec::push</code> writes to that memory again afterwards</p>



<a name="184650769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650769">(Jan 02 2020 at 13:28)</a>:</h4>
<p>i.e.,</p>
<div class="codehilite"><pre><span></span><span class="kd">let</span><span class="w"> </span><span class="n">a</span>: <span class="nc">T</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">...;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">a</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">b</span>: <span class="nc">T</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">...;</span><span class="w"> </span><span class="c1">// can be put in the same place as a</span>
</pre></div>



<a name="184650799"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650799" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650799">(Jan 02 2020 at 13:29)</a>:</h4>
<p>For that optimization to happen we don't really need the extra guarantee on <code>drop_in_place</code> I think</p>



<a name="184650806"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650806" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650806">(Jan 02 2020 at 13:29)</a>:</h4>
<p>hm, I'm confused</p>



<a name="184650811"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650811" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650811">(Jan 02 2020 at 13:29)</a>:</h4>
<p><code>Vec::pop</code> shouldn't be calling drop_in_place?</p>



<a name="184650879"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650879" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650879">(Jan 02 2020 at 13:30)</a>:</h4>
<p>Sorry, <code>Vec::truncate(N)</code> for example</p>



<a name="184650912"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650912" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650912">(Jan 02 2020 at 13:31)</a>:</h4>
<p><a href="https://doc.rust-lang.org/src/alloc/vec.rs.html#729-750" target="_blank" title="https://doc.rust-lang.org/src/alloc/vec.rs.html#729-750">https://doc.rust-lang.org/src/alloc/vec.rs.html#729-750</a></p>



<a name="184650914"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650914" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650914">(Jan 02 2020 at 13:31)</a>:</h4>
<p>yes, I think this is a bit different, because there the memory is on the heap</p>



<a name="184650923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650923">(Jan 02 2020 at 13:31)</a>:</h4>
<p>yes, I was talking in general about how we would write the <code>ptr::drop_in_place</code> docs</p>



<a name="184650924"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650924" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650924">(Jan 02 2020 at 13:31)</a>:</h4>
<p>maybe that's not a meaningful distinction (and I'm not sure that we want to make it in the abstract machine)</p>



<a name="184650936"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650936" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650936">(Jan 02 2020 at 13:31)</a>:</h4>
<p>I think that the optimization you want to perform is reasonable</p>



<a name="184650981"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650981" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650981">(Jan 02 2020 at 13:32)</a>:</h4>
<p>and doable on the stack, but not as simple  in general on the heap (maybe?)</p>



<a name="184650992"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184650992" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184650992">(Jan 02 2020 at 13:32)</a>:</h4>
<p>I'm not sure we'd need to prevent users from writing to the <code>ptr</code> after a <code>drop_in_place</code> (or even reading) to allow it</p>



<a name="184651001"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651001" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651001">(Jan 02 2020 at 13:32)</a>:</h4>
<p>like, right now, we can already perform this optimization as long as the user cannot tell (we can spill values from registers to the stack and back)</p>



<a name="184651013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651013">(Jan 02 2020 at 13:33)</a>:</h4>
<p>well, the advantage to making this guarantee is that e.g. generators could use it for layout optimization I think</p>



<a name="184651019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651019">(Jan 02 2020 at 13:33)</a>:</h4>
<p>which I guess is already true under "as if" to an extent, as you say</p>



<a name="184651086"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651086" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651086">(Jan 02 2020 at 13:34)</a>:</h4>
<p>e.g. </p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">i32</span> <span class="p">{</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">b</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="n">b</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


<p>here <code>b</code> could be put in the same place as <code>a</code>, and well, it doesn't to be put in the stack at all.</p>



<a name="184651092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651092">(Jan 02 2020 at 13:34)</a>:</h4>
<p>I guess -- maybe a more reasonable and universal (not dependent on where *mut T points to) definition is that <code>drop_in_place</code> is allowed to leave the value in an invalid state</p>



<a name="184651122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651122">(Jan 02 2020 at 13:35)</a>:</h4>
<p>but that you are allowed to write to that pointer (e.g., via <code>ptr::write</code>)</p>



<a name="184651126"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651126" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651126">(Jan 02 2020 at 13:35)</a>:</h4>
<p>I think it would be just simpler to say that <code>ptr::drop_in_place</code> calls <code>Drop::drop(&amp;mut *ptr)</code> and that's it</p>



<a name="184651132"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651132" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651132">(Jan 02 2020 at 13:35)</a>:</h4>
<p>Well, that's different, right?</p>



<a name="184651133"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651133" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651133">(Jan 02 2020 at 13:35)</a>:</h4>
<p>that means that the value behind the <code>*mut T</code> must be valid, and must be left in a valid state</p>



<a name="184651144"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651144" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651144">(Jan 02 2020 at 13:36)</a>:</h4>
<p>Like, that's not "simpler", that's a different definition</p>



<a name="184651145"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651145" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651145">(Jan 02 2020 at 13:36)</a>:</h4>
<p>not necessarily in a safe state</p>



<a name="184651203"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651203" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651203">(Jan 02 2020 at 13:36)</a>:</h4>
<p>well, that's how I understand the current definition, given the feedback that <span class="user-mention" data-user-id="224471">@Lokathor</span> gave above</p>



<a name="184651214"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651214" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651214">(Jan 02 2020 at 13:36)</a>:</h4>
<p>I'm not talking about a current definition</p>



<a name="184651219"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651219" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651219">(Jan 02 2020 at 13:36)</a>:</h4>
<p>that still allows your optimization</p>



<a name="184651240"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651240" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651240">(Jan 02 2020 at 13:37)</a>:</h4>
<p>or maybe put differently, is there an example for which that definition does not allow your optimization ?</p>



<a name="184651244"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651244" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651244">(Jan 02 2020 at 13:37)</a>:</h4>
<p>I'm saying that <code>ptr::drop_in_place</code> can leave value in an invalid state is different from <code>ptr::drop_in_place</code> calls <code>Drop::drop(&amp;mut *ptr)</code></p>



<a name="184651251"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651251" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651251">(Jan 02 2020 at 13:37)</a>:</h4>
<p>sure, those are different</p>



<a name="184651302"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651302" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651302">(Jan 02 2020 at 13:38)</a>:</h4>
<p>I wouldn't say that your definition leaves the value in an invalid state, as that is instant UB because it means an invalid value was created, and then written to some address</p>



<a name="184651307"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651307" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651307">(Jan 02 2020 at 13:38)</a>:</h4>
<p>i would say it writes a different value to the memory behind the pointer</p>



<a name="184651320"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651320" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651320">(Jan 02 2020 at 13:38)</a>:</h4>
<p>we could maybe change the definition to this one, but I fail to see what it buys us</p>



<a name="184651341"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651341" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651341">(Jan 02 2020 at 13:39)</a>:</h4>
<p>I would say that the memory is left invalid, which is <em>not</em> UB, because it is the compiler/language doing it, i.e., conceptually there is no more T at that place</p>



<a name="184651414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651414">(Jan 02 2020 at 13:40)</a>:</h4>
<p>If there is no more T, there is something else there.</p>



<a name="184651423"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651423" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651423">(Jan 02 2020 at 13:40)</a>:</h4>
<p>I'm not sure that it buys us anything, that's true. I think unless we go further and start talking about the stack/heap distinction it probably doesn't</p>



<a name="184651439"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651439" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651439">(Jan 02 2020 at 13:40)</a>:</h4>
<p>Even going for the stack / heap distinction, is there an optimization that we can't do without that ?</p>



<a name="184651462"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651462" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651462">(Jan 02 2020 at 13:41)</a>:</h4>
<p>You mentioned generators before, but I can't think of one optimization that isn't possible without this.</p>



<a name="184651467"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651467" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651467">(Jan 02 2020 at 13:41)</a>:</h4>
<p>reusing the stack slot when the pointer is passed into unknown code (so we can't know what it does with it)</p>



<a name="184651555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651555">(Jan 02 2020 at 13:42)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="kd">let</span><span class="w"> </span><span class="n">a</span>: <span class="nc">T</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">...;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">ptr</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">a</span><span class="p">;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="n">ptr</span><span class="p">);</span><span class="w"></span>
<span class="n">some_c_function</span><span class="p">(</span><span class="n">ptr</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">b</span>: <span class="nc">T</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">...;</span><span class="w"> </span><span class="c1">// can be put in the same place as a</span>
</pre></div>



<a name="184651610"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651610" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651610">(Jan 02 2020 at 13:43)</a>:</h4>
<p>But that code does not use <code>a</code> after <code>some_c_function</code>, so <code>b</code> can always be put in the same place as <code>a</code></p>



<a name="184651635"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651635" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651635">(Jan 02 2020 at 13:43)</a>:</h4>
<p>well, per your rules, we can't, no</p>



<a name="184651643"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651643" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651643">(Jan 02 2020 at 13:43)</a>:</h4>
<p>because the slot has "leaked" through <code>ptr</code>, right?</p>



<a name="184651659"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651659" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651659">(Jan 02 2020 at 13:43)</a>:</h4>
<p>Ah, indeed, yes</p>



<a name="184651746"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651746" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651746">(Jan 02 2020 at 13:44)</a>:</h4>
<p>So that unknown code can't do anything with the <code>ptr</code> according to your definition right?</p>



<a name="184651756"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651756" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651756">(Jan 02 2020 at 13:45)</a>:</h4>
<p>It can't read from it, it can't write to it</p>



<a name="184651763"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651763" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651763">(Jan 02 2020 at 13:45)</a>:</h4>
<p>It can just copy it around</p>



<a name="184651767"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651767" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651767">(Jan 02 2020 at 13:45)</a>:</h4>
<p>(deleted)</p>



<a name="184651787"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651787" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651787">(Jan 02 2020 at 13:45)</a>:</h4>
<p>sure</p>



<a name="184651838"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651838" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651838">(Jan 02 2020 at 13:46)</a>:</h4>
<p>it's basically just a <code>usize</code> for that code</p>



<a name="184651853"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651853" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651853">(Jan 02 2020 at 13:46)</a>:</h4>
<p>and this optimization is important?</p>



<a name="184651881"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651881" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651881">(Jan 02 2020 at 13:47)</a>:</h4>
<p>perhaps for generators to avoid non-local analysis (i.e., without inlining)</p>



<a name="184651891"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651891" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651891">(Jan 02 2020 at 13:47)</a>:</h4>
<p>but to be honest, probably no</p>



<a name="184651909"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651909" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651909">(Jan 02 2020 at 13:47)</a>:</h4>
<p>maybe it would be worth it to try to come up with a generator example</p>



<a name="184651921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184651921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184651921">(Jan 02 2020 at 13:47)</a>:</h4>
<p>well, basically copy/pasting mine, right? With an <code>.await</code> after the C call</p>



<a name="184652006"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652006" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652006">(Jan 02 2020 at 13:49)</a>:</h4>
<p>I mean, even with the <code>.await</code>, the example is still not very useful, because the non-local code can't do anything with the <code>ptr</code> in your example</p>



<a name="184652014"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652014" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652014">(Jan 02 2020 at 13:49)</a>:</h4>
<p>except for passing it around</p>



<a name="184652021"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652021" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652021">(Jan 02 2020 at 13:49)</a>:</h4>
<p>only under my proposal, right?</p>



<a name="184652024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652024">(Jan 02 2020 at 13:49)</a>:</h4>
<p>right</p>



<a name="184652035"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652035" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652035">(Jan 02 2020 at 13:49)</a>:</h4>
<p>with my proposal, the non-local code can read/write to the value, so its stack cannot be reused</p>



<a name="184652040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652040">(Jan 02 2020 at 13:49)</a>:</h4>
<p>right, exactly</p>



<a name="184652053"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652053" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652053">(Jan 02 2020 at 13:50)</a>:</h4>
<p>but that's useful</p>



<a name="184652099"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652099" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652099">(Jan 02 2020 at 13:50)</a>:</h4>
<p>you can at least read or write to the value, and re-initialize it to something else if you want</p>



<a name="184652122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652122">(Jan 02 2020 at 13:50)</a>:</h4>
<p>I would personally want to say that we should have a model which says that reading from such a value is not defined</p>



<a name="184652134"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652134" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652134">(Jan 02 2020 at 13:51)</a>:</h4>
<p>but I would be okay saying that writing to it is</p>



<a name="184652158"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652158" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652158">(Jan 02 2020 at 13:51)</a>:</h4>
<p>i'm not opposed to that, but i'd prefer to balance optimizations with specification simplicity</p>



<a name="184652163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652163">(Jan 02 2020 at 13:51)</a>:</h4>
<p>that basically means that we can reuse the stack slot for other values, without "cleaning up" after ourselves, so long as we can see that the code is not using it</p>



<a name="184652168"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652168" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652168">(Jan 02 2020 at 13:51)</a>:</h4>
<p>if there are optimizations that are worth performing, then we should try to do so</p>



<a name="184652245"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652245" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652245">(Jan 02 2020 at 13:52)</a>:</h4>
<p>I think a model which says <code>ptr::drop_in_place</code> leaves the place in an invalid state, but does not invalidate the place itself (i.e., the pointer points to 'usable' memory) is pretty straightforward</p>



<a name="184652251"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652251" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652251">(Jan 02 2020 at 13:53)</a>:</h4>
<p>If <code>ptr::drop_in_place(ptr)</code> "desugars" to <code>Drop::drop(&amp;mut *ptr)</code>, then I think reasoning about it is quite simple, because everything else users have to know about <code>Drop::drop</code> and pointers and values just translates to it</p>



<a name="184652291"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652291" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652291">(Jan 02 2020 at 13:53)</a>:</h4>
<p>Like, that desugaring implies that the value behind <code>ptr</code> must be valid before the <code>ptr::drop_in_place</code> call, that it is left in a valid state, so reading / writing to it using <code>ptr::{read,write}</code> is ok, etc.</p>



<a name="184652345"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652345" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652345">(Jan 02 2020 at 13:54)</a>:</h4>
<p>The only reason <code>drop_in_place</code> is unsafe is because <code>Drop::drop</code> does not necessarily leave the value in a "safe" state</p>



<a name="184652385"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652385" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652385">(Jan 02 2020 at 13:55)</a>:</h4>
<p>okay, but then I would argue that we should have changed (or should change, if we can) ptr::drop_in_place to take <code>&amp;mut T</code></p>



<a name="184652392"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652392" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652392">(Jan 02 2020 at 13:55)</a>:</h4>
<p>It means that we don't have to make <code>drop_in_place</code> a "special" primitive, and that we don't have to add a new state for a "dropped" value to the abstract machine</p>



<a name="184652398"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652398" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652398">(Jan 02 2020 at 13:55)</a>:</h4>
<blockquote>
<p>okay, but then I would argue that we should have changed (or should change, if we can) ptr::drop_in_place to take &amp;mut T</p>
</blockquote>
<p>+1</p>



<a name="184652407"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652407" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652407">(Jan 02 2020 at 13:55)</a>:</h4>
<p>Like, I at least have no idea why this isn't the case</p>



<a name="184652468"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652468" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652468">(Jan 02 2020 at 13:56)</a>:</h4>
<p>I mean, I guess the only reason might be ergonomics, as in, one typically uses <code>ptr::drop_in_place</code> when working with raw pointers.</p>



<a name="184652482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652482">(Jan 02 2020 at 13:56)</a>:</h4>
<p>and a reference coerces to one, so the current API works for both cases</p>



<a name="184652509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184652509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184652509">(Jan 02 2020 at 13:57)</a>:</h4>
<p>but yeah, I've had the same feeling while thinking about these issues, why doesn't <code>ptr::drop_in_place</code> take a <code>&amp;mut T</code> ?</p>



<a name="184653148"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184653148" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184653148">(Jan 02 2020 at 14:06)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/issues/27908" target="_blank" title="https://github.com/rust-lang/rust/issues/27908">https://github.com/rust-lang/rust/issues/27908</a></p>



<a name="184653201"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184653201" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184653201">(Jan 02 2020 at 14:07)</a>:</h4>
<p>Seems like basically we stabilized without answering the question</p>



<a name="184653332"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184653332" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184653332">(Jan 02 2020 at 14:09)</a>:</h4>
<p>certainly there's some discussion about leaving the value in an invalid state</p>



<a name="184654643"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654643" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654643">(Jan 02 2020 at 14:26)</a>:</h4>
<p>Thanks</p>



<a name="184654698"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654698" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654698">(Jan 02 2020 at 14:27)</a>:</h4>
<p>When they talk about "invalidation", I'm not sure they are using the word with the same meaning that we use now</p>



<a name="184654708"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654708" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654708">(Jan 02 2020 at 14:27)</a>:</h4>
<p>yeah, I don't think it was around then as a meaning, or at least certainly less formal</p>



<a name="184654709"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654709" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654709">(Jan 02 2020 at 14:27)</a>:</h4>
<p>Looks like they are talking more about violating the safety invariant, than the validity invariant</p>



<a name="184654772"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654772" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654772">(Jan 02 2020 at 14:28)</a>:</h4>
<p>I think we don't guarantee that <code>&amp;mut T</code> must satisfy the safety invariant, right?</p>



<a name="184654782"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654782" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654782">(Jan 02 2020 at 14:28)</a>:</h4>
<p>(Obviously we can't do anything about safety optimization wise anyway)</p>



<a name="184654795"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654795" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654795">(Jan 02 2020 at 14:29)</a>:</h4>
<p>No, I don't think so.</p>
<div class="codehilite"><pre><span></span><span class="c1">// I woke up today and it is only safe to create an OnlyOne(1) value.</span>
<span class="k">struct</span> <span class="nc">OnlyOne</span><span class="p">(</span><span class="kt">i32</span><span class="p">);</span><span class="w"></span>

<span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span>: <span class="nc">OnlyOne</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">y</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="p">.</span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
</pre></div>



<a name="184654796"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654796" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654796">(Jan 02 2020 at 14:29)</a>:</h4>
<p>with that in mind, we could presumably make <code>fn drop_in_place(&amp;mut T)</code> safe, right?</p>



<a name="184654820"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654820" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654820">(Jan 02 2020 at 14:29)</a>:</h4>
<p>that would sort of fully answer all the questions</p>



<a name="184654827"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654827" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654827">(Jan 02 2020 at 14:29)</a>:</h4>
<p>although, actually, no</p>



<a name="184654838"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654838" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654838">(Jan 02 2020 at 14:29)</a>:</h4>
<p>since we want to guarantee it's called just the once, right?</p>



<a name="184654841"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654841" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654841">(Jan 02 2020 at 14:29)</a>:</h4>
<p>nono</p>



<a name="184654891"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654891" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654891">(Jan 02 2020 at 14:30)</a>:</h4>
<p>Safe code cannot violate the safety invariant</p>



<a name="184654903"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654903" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654903">(Jan 02 2020 at 14:30)</a>:</h4>
<p>In unsafe code, you can violate the safety invariant, as long as you restore it at the safe code boundary</p>



<a name="184654916"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654916" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654916">(Jan 02 2020 at 14:30)</a>:</h4>
<p>okay, sure, though that boundary is sort of murky I think</p>



<a name="184654931"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654931" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654931">(Jan 02 2020 at 14:31)</a>:</h4>
<p>So, e.g., </p>
<div class="codehilite"><pre><span></span><span class="k">impl</span><span class="w"> </span><span class="n">OnlyOne</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">new</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="nc">Self</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">Self</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="c1">// safe</span>
<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="k">fn</span> <span class="nf">new_unchecked</span><span class="p">(</span><span class="n">x</span>: <span class="kt">i32</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="nc">Self</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">Self</span><span class="p">(</span><span class="n">x</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="184654976"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184654976" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184654976">(Jan 02 2020 at 14:31)</a>:</h4>
<p>A concrete proposal for drop_in_place then is:</p>
<ul>
<li>should take <code>&amp;mut T</code></li>
<li>must leave value in a valid, but not necessarily safe, way</li>
<li>may be UB to call twice (due to safety invariant)</li>
</ul>



<a name="184655028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655028">(Jan 02 2020 at 14:32)</a>:</h4>
<p>There, it would be "ok" for <code>new_unchecked</code> to look like this:</p>
<div class="codehilite"><pre><span></span><span class="k">unsafe</span><span class="w"> </span><span class="k">fn</span> <span class="nf">new_unchecked</span><span class="p">(</span><span class="n">x</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="nc">Self</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">OnlyOne</span><span class="p">(</span><span class="mi">42</span><span class="p">);</span><span class="w"> </span><span class="c1">// valid but unsafe</span>
<span class="w">    </span><span class="n">a</span><span class="p">.</span><span class="mi">0</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">x</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="n">a</span><span class="w">  </span><span class="c1">// Ok, returns a potentially unsafe OnlyOne</span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="184655039"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655039" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655039">(Jan 02 2020 at 14:32)</a>:</h4>
<p>sure, yes</p>



<a name="184655052"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655052" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655052">(Jan 02 2020 at 14:33)</a>:</h4>
<p>though that could be a safe function?</p>



<a name="184655060"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655060" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655060">(Jan 02 2020 at 14:33)</a>:</h4>
<p>oh, you dropped the assert, okay</p>



<a name="184655068"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655068" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655068">(Jan 02 2020 at 14:33)</a>:</h4>
<p>yeah, sorry, the assert was making the unsafe pointless</p>



<a name="184655122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655122">(Jan 02 2020 at 14:34)</a>:</h4>
<p>In the issue you posted they discuss about adding a <code>mem::drop_in_place(&amp;mut T)</code> API</p>



<a name="184655131"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655131" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655131">(Jan 02 2020 at 14:34)</a>:</h4>
<p>We could do that, and maybe deprecate the <code>ptr::</code> one, or at least warn, don't know</p>



<a name="184655161"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655161" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655161">(Jan 02 2020 at 14:35)</a>:</h4>
<p>I think there's not much point</p>



<a name="184655173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655173">(Jan 02 2020 at 14:35)</a>:</h4>
<p>I mean, it is not UB to call it twice</p>



<a name="184655174"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655174" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655174">(Jan 02 2020 at 14:35)</a>:</h4>
<p>A concrete proposal for drop_in_place then is:</p>
<ul>
<li>should take <code>&amp;mut T</code> (or be documented as such, if we don't decide to change things)</li>
<li>must leave value in a valid, but not necessarily safe, way</li>
<li>may be UB to call twice (due to safety invariant)</li>
</ul>



<a name="184655233"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655233" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655233">(Jan 02 2020 at 14:36)</a>:</h4>
<p>Yes, we should expand the docs on why the last point is true</p>



<a name="184655513"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655513" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655513">(Jan 02 2020 at 14:41)</a>:</h4>
<p><code>ptr::drop_in_place</code> calls <code>Drop::drop</code> which is a safe API that is allowed to leave the value in a potentially _unsafe_ state (depending on the particular <code>Drop</code> implementation). All safe Rust APIs, including <code>Drop::drop</code> require their arguments to be in a _safe_ state, and this is why for some <code>Drop</code> implementations, double drops are unsound.</p>



<a name="184655587"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655587" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655587">(Jan 02 2020 at 14:42)</a>:</h4>
<p>AFAICT, because <code>Drop::drop</code> is safe, then <code>&amp;mut self</code> must point to a <code>self</code> that's in a safe state, and if it isn't, the program is unsound. Whether you can double drop those types would then depend on whether <code>Drop::drop</code> breaks the safety invariant or not.</p>



<a name="184655635"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655635" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655635">(Jan 02 2020 at 14:43)</a>:</h4>
<p><code>Drop::drop</code> being safe doesn't matter</p>



<a name="184655693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655693">(Jan 02 2020 at 14:44)</a>:</h4>
<p>oh, safe state, then yes</p>



<a name="184655694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655694">(Jan 02 2020 at 14:44)</a>:</h4>
<p>It kind of does, because safe functions don't have a <code># Safety</code> clause.</p>



<a name="184655713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655713">(Jan 02 2020 at 14:44)</a>:</h4>
<p>though Drop::drop is notable in being able to violate the safety invariant on exit</p>



<a name="184655737"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655737" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655737">(Jan 02 2020 at 14:45)</a>:</h4>
<p>Only if it takes ownership of the value</p>



<a name="184655749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655749">(Jan 02 2020 at 14:45)</a>:</h4>
<p>If you want to drop a value without taking ownership, then you need to use <code>ptr::drop_in_place</code>, which is unsafe for this reason.</p>



<a name="184655756"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655756" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655756">(Jan 02 2020 at 14:45)</a>:</h4>
<p>Typically this would be expressed by making <code>Drop::drop</code> unsafe..</p>



<a name="184655838"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655838" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655838">(Jan 02 2020 at 14:46)</a>:</h4>
<p>Drop::drop is special and basically unsafe</p>



<a name="184655853"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655853" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655853">(Jan 02 2020 at 14:47)</a>:</h4>
<p>Yeah</p>



<a name="184655888"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655888" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655888">(Jan 02 2020 at 14:47)</a>:</h4>
<p>I'm not sure why we need <code>ptr::drop_in_place(ptr)</code> at all</p>



<a name="184655892"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655892" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655892">(Jan 02 2020 at 14:47)</a>:</h4>
<p>Where one of the safety constraints is "don't call me again" by default, though some Drop::drop are less strict</p>



<a name="184655893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655893">(Jan 02 2020 at 14:47)</a>:</h4>
<p>can't we just use <code>unsafe { Drop::drop(&amp;mut v) }</code> ?</p>



<a name="184655944"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655944" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655944">(Jan 02 2020 at 14:48)</a>:</h4>
<p>hm, well, maybe, but you can't actually call Drop::drop, the compiler won't let you</p>



<a name="184655949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655949">(Jan 02 2020 at 14:48)</a>:</h4>
<p>(maybe it should)</p>



<a name="184655990"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184655990" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184655990">(Jan 02 2020 at 14:49)</a>:</h4>
<p>yes, maybe</p>



<a name="184656002"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656002" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656002">(Jan 02 2020 at 14:49)</a>:</h4>
<p>There are some other parts of the language were <code>unsafe</code> is too "general"</p>



<a name="184656011"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656011" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656011">(Jan 02 2020 at 14:49)</a>:</h4>
<p>And what we want to express is <code>unsafe(to_call_explicitly) fn drop(&amp;mut self) { ... }</code></p>



<a name="184656072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656072">(Jan 02 2020 at 14:50)</a>:</h4>
<p>hm, why'd we want that? It's just unsafe period</p>



<a name="184656103"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656103" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656103">(Jan 02 2020 at 14:51)</a>:</h4>
<p>you can do unsafe things inside it</p>



<a name="184656113"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656113" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656113">(Jan 02 2020 at 14:51)</a>:</h4>
<p>Well because we don't want unsafe code inside them by default</p>



<a name="184656126"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656126" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656126">(Jan 02 2020 at 14:51)</a>:</h4>
<p>e.g. </p>
<div class="codehilite"><pre><span></span><span class="k">unsafe</span><span class="w"> </span><span class="k">fn</span> <span class="nf">drop</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="bp">self</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="n">raw</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="n">deref</span><span class="w"> </span><span class="n">is</span><span class="w"> </span><span class="n">ok</span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>



<a name="184656134"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656134" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656134">(Jan 02 2020 at 14:51)</a>:</h4>
<p>sure</p>



<a name="184656187"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184656187" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184656187">(Jan 02 2020 at 14:52)</a>:</h4>
<p>I think there was an issue about requiring explicit unsafe blocks in unsafe fn, I guess for drop that would also solve it</p>



<a name="184661097"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184661097" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184661097">(Jan 02 2020 at 15:56)</a>:</h4>
<p><code>Drop::drop</code> is not  (primarily) unsafe to call, it's never sensible to call (outside of the compiler-generated drop glue). <code>Drop::drop</code> only handles custom per-type drop logic, not the recursive dropping of fields. So it can't replace <code>ptr::drop_in_place</code> and there's also no other reason to allow calling it manually.</p>



<a name="184661136"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184661136" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184661136">(Jan 02 2020 at 15:57)</a>:</h4>
<p>ah, that's a good point</p>



<a name="184661142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184661142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184661142">(Jan 02 2020 at 15:57)</a>:</h4>
<p>I forgot about the recursive bit</p>



<a name="184664415"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184664415" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184664415">(Jan 02 2020 at 16:40)</a>:</h4>
<blockquote>
<p>For a type like <code>i32</code>, a double drop is not UB, according to the model being discussed here</p>
</blockquote>
<p>I agree, <em>if</em> we assume that uninit memory is never allowed for <code>i32</code>. But as you like to note yourself, it is not legal for code to rely on something being UB -- we might allow uninit ints in the future.</p>



<a name="184664548"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184664548" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184664548">(Jan 02 2020 at 16:42)</a>:</h4>
<blockquote>
<p>I mean, if <code>ptr::drop_in_place(ptr)</code> changes the state of the memory behind <code>ptr</code>, it needs to do so by "writting" to that <code>ptr</code> "somehow"</p>
</blockquote>
<p>well it could do <code>*(ptr as *mut u8) = 3</code>, for example, so I don't think there is anything "automatic" here</p>



<a name="184664621"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184664621" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184664621">(Jan 02 2020 at 16:43)</a>:</h4>
<p>but IMO the <em>safety</em> contract of <code>drop</code> should prohibit that</p>



<a name="184664630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184664630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184664630">(Jan 02 2020 at 16:43)</a>:</h4>
<p>(and that is the only user-defined part of <code>drop_in_place</code>, after all)</p>



<a name="184664707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184664707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184664707">(Jan 02 2020 at 16:44)</a>:</h4>
<p>oh, sorry, discussion went on after these things but Zulip failed to load it... never mind then</p>



<a name="184665035"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665035" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665035">(Jan 02 2020 at 16:48)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span>  I think <span class="user-mention" data-user-id="132920">@gnzlbg</span> and I agreed on this:</p>
<p>A concrete proposal for drop_in_place then is:</p>
<ul>
<li>should take <code>&amp;mut T</code> (or be documented as such, if we don't decide to change things)</li>
<li>must leave value in a valid, but not necessarily safe, way</li>
<li>may be UB to call twice (due to safety invariant)</li>
</ul>



<a name="184665052"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665052" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665052">(Jan 02 2020 at 16:48)</a>:</h4>
<p>which I believe is consistent with today's world</p>



<a name="184665587"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665587" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665587">(Jan 02 2020 at 16:55)</a>:</h4>
<p>well, <code>drop_in_place</code> is compiler-implemented, so we can't really <em>require</em> anything for it as much as <em>guarantee</em> that it has certain properties</p>



<a name="184665637"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665637" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665637">(Jan 02 2020 at 16:56)</a>:</h4>
<p>the only place we have for making requirements is <code>Drop::drop</code></p>



<a name="184665739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665739">(Jan 02 2020 at 16:57)</a>:</h4>
<p>not sure how I feel about it taking <code>&amp;mut</code>, I guess that could be correct but it seems weird.<br>
this reminds me, I think I can remove the <code>real_drop_in_place</code> again that I added a while back as a hack for earlier versions of Stacked Borrows...</p>



<a name="184665849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665849">(Jan 02 2020 at 16:59)</a>:</h4>
<p>ah, yes, these would be the guarantees, sure</p>



<a name="184665872"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665872" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665872">(Jan 02 2020 at 16:59)</a>:</h4>
<p>I think these all apply as requirements to Drop::drop too</p>



<a name="184665890"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665890" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665890">(Jan 02 2020 at 16:59)</a>:</h4>
<p>(where we substitute call for "cause to be called" or so)</p>



<a name="184665959"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665959" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665959">(Jan 02 2020 at 17:00)</a>:</h4>
<p>well the requirements are stronger there I think</p>



<a name="184665990"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184665990" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184665990">(Jan 02 2020 at 17:00)</a>:</h4>
<p>like, it must leave the fields in a "drop-valid" state... that's weaker than "safety invariant" but stronger than "validity invariant", e.g. it is wrong for <code>drop</code> to leave a field of type <code>Vec</code> in a state that is valid but unsafe (and leads to the later <code>Vec::drop</code> failing)</p>



<a name="184666027"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184666027" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184666027">(Jan 02 2020 at 17:01)</a>:</h4>
<p>ah, yes, that's true</p>



<a name="184666095"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184666095" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184666095">(Jan 02 2020 at 17:02)</a>:</h4>
<p>we could approximate this with "safety invariant of each field" but maybe there's good use for violating that after dropping</p>



<a name="184666154"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184666154" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184666154">(Jan 02 2020 at 17:03)</a>:</h4>
<p>well -- one could imagine -- e.g., resetting some sort of <code>Once</code> primitive on drop so it can be reused which is technically unsafe (code relies on it being once only), but since you know you're about to drop it it's fine</p>



<a name="184666161"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184666161" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184666161">(Jan 02 2020 at 17:03)</a>:</h4>
<p>hard to come up with examples :)</p>



<a name="184734128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184734128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184734128">(Jan 03 2020 at 13:42)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> agreed with all you said.</p>
<blockquote>
<p>I agree, if we assume that uninit memory is never allowed for i32. But as you like to note yourself, it is not legal for code to rely on something being UB -- we might allow uninit ints in the future.</p>
</blockquote>
<p>I'm not sure I understand this claim. If we allow <code>i32</code> to become <code>uninit</code>, why wouldn't it be ok to double-drop it?</p>



<a name="184750916"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184750916" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184750916">(Jan 03 2020 at 17:22)</a>:</h4>
<p>ah I guess dropping <code>uninit</code> would also be fine then... never mind then</p>



<a name="184761206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/184761206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#184761206">(Jan 03 2020 at 19:36)</a>:</h4>
<p>What would be the best place to document this? Should I open an issue in rust-lang/rust to discuss how to add this to the Drop trait docs ?</p>



<a name="185052834"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185052834" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185052834">(Jan 07 2020 at 20:44)</a>:</h4>
<p>I guess that would be a good place? is there anything drop-related in the reference or the nomicon?</p>



<a name="185691030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185691030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185691030">(Jan 15 2020 at 12:02)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> something very related just came up on reddit: <a href="https://www.reddit.com/r/rust/comments/eowihi/what_invariants_must_hold_to_access_an_objects/" target="_blank" title="https://www.reddit.com/r/rust/comments/eowihi/what_invariants_must_hold_to_access_an_objects/">https://www.reddit.com/r/rust/comments/eowihi/what_invariants_must_hold_to_access_an_objects/</a></p>



<a name="185691034"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185691034" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185691034">(Jan 15 2020 at 12:02)</a>:</h4>
<p>is there anywhere that we can point them to, currently?</p>



<a name="185695166"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695166" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695166">(Jan 15 2020 at 13:05)</a>:</h4>
<p><del>I think that issue is simpler</del> That does look like the same issue</p>



<a name="185695269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695269">(Jan 15 2020 at 13:06)</a>:</h4>
<p>(deleted)</p>



<a name="185695291"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695291" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695291">(Jan 15 2020 at 13:06)</a>:</h4>
<p>(deleted)</p>



<a name="185695353"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695353" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695353">(Jan 15 2020 at 13:07)</a>:</h4>
<p>(deleted)</p>



<a name="185695437"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695437" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695437">(Jan 15 2020 at 13:08)</a>:</h4>
<p>(deleted)</p>



<a name="185695451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695451">(Jan 15 2020 at 13:08)</a>:</h4>
<p>(deleted)</p>



<a name="185695494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695494">(Jan 15 2020 at 13:09)</a>:</h4>
<p>(deleted)</p>



<a name="185695566"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695566" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695566">(Jan 15 2020 at 13:10)</a>:</h4>
<p>(deleted)</p>



<a name="185695589"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695589" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695589">(Jan 15 2020 at 13:10)</a>:</h4>
<p>(deleted)</p>



<a name="185695891"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695891" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695891">(Jan 15 2020 at 13:14)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I think we should just document this in the API docs of Drop</p>



<a name="185695990"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185695990" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185695990">(Jan 15 2020 at 13:16)</a>:</h4>
<p>Document that <code>ptr::drop_in_place(ptr: *mut T)</code>:</p>
<p>* requires exclusive access to <code>ptr</code> (as if it were an <code>&amp;mut T</code>)<br>
  * must probably leave the memory behind pointer in a valid state</p>



<a name="185696040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185696040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185696040">(Jan 15 2020 at 13:16)</a>:</h4>
<p>and I say probably because I'm not sure, the validity is only required if you somehow use the value afterwards:</p>



<a name="185696159"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185696159" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185696159">(Jan 15 2020 at 13:18)</a>:</h4>
<p>e.g. </p>
<div class="codehilite"><pre><span></span><span class="kd">let</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">GlobalAlloc</span>::<span class="n">alloc</span><span class="p">(..</span><span class="n">big</span><span class="w"> </span><span class="n">enough</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">T</span><span class="p">..);</span><span class="w"></span>
<span class="n">ptr</span><span class="p">.</span><span class="n">write</span><span class="p">(...</span><span class="n">some</span><span class="w"> </span><span class="n">T</span><span class="w"> </span><span class="n">value</span><span class="p">...);</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">drop_in_place</span><span class="p">(</span><span class="o">&amp;*</span><span class="n">ptr</span><span class="p">.</span><span class="n">field_of_T</span><span class="p">);</span><span class="w"></span>
<span class="n">forget</span><span class="p">(</span><span class="n">ptr</span><span class="p">);</span><span class="w"> </span><span class="c1">// leaked</span>
</pre></div>



<a name="185696323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185696323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185696323">(Jan 15 2020 at 13:20)</a>:</h4>
<p>There AFAICT it wouldn't matter if <code>drop_in_place</code> leaves a field of <code>T</code> in an invalid state, because there is no reference to that value anywhere after the call returns, only a raw pointer, which gets leaked, meaning nobody can access the memory anymore</p>



<a name="185713344"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185713344" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185713344">(Jan 15 2020 at 16:15)</a>:</h4>
<p>you don't need to forget the pointer</p>



<a name="185713501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185713501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185713501">(Jan 15 2020 at 16:17)</a>:</h4>
<blockquote>
<p>must probably leave the memory behind pointer in a valid state</p>
</blockquote>
<p>"<em>will</em> leave", I assume? this is documenting the guarantees libcore provides to the user. any "must" clause should be added to <code>Drop::drop</code>.</p>



<a name="185713667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185713667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185713667">(Jan 15 2020 at 16:18)</a>:</h4>
<p><code>ptr::drop_in_place</code> calls user-defined <code>Drop</code>s, so I don't see how <code>libcore</code> could make that guarantee, unless we require that all <code>Drop</code> implementations provide it</p>



<a name="185713941"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185713941" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185713941">(Jan 15 2020 at 16:20)</a>:</h4>
<p>I think the best place to document all this is the <code>Drop</code> trait, the only thing <code>ptr::drop_in_place</code> might want to document is that the raw pointer will be used as a <code>&amp;mut T</code>, and maybe mention potential pitfalls like the one being discussed here, but all of that should also be explained in the <code>Drop</code> trait</p>



<a name="185729258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185729258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185729258">(Jan 15 2020 at 18:38)</a>:</h4>
<blockquote>
<p><code>ptr::drop_in_place</code> calls user-defined <code>Drop</code>s, so I don't see how <code>libcore</code> could make that guarantee, unless we require that all <code>Drop</code> implementations provide it</p>
</blockquote>
<p>indeed, <code>Drop</code> is the place where we will have to require whatever we need to guarantee what we document at <code>drop_in_place</code></p>



<a name="185729298"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185729298" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185729298">(Jan 15 2020 at 18:39)</a>:</h4>
<p>but having requirements at <code>drop_in_place</code> makes no sense -- as little sense as it would for any other stdlib function</p>



<a name="185729312"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate%20through%20drop/near/185729312" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/invalidate.20through.20drop.html#185729312">(Jan 15 2020 at 18:39)</a>:</h4>
<blockquote>
<p>I think the best place to document all this is the <code>Drop</code> trait, the only thing <code>ptr::drop_in_place</code> might want to document is that the raw pointer will be used as a <code>&amp;mut T</code>, and maybe mention potential pitfalls like the one being discussed here, but all of that should also be explained in the <code>Drop</code> trait</p>
</blockquote>
<p>I agree it makes sense to centralize the docs</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>